devlyn-cli 2.9.3 → 2.10.1

package/AGENTS.md

@@ -10,7 +10,7 @@ This contract serves one goal: any capable engine — Claude, GPT/Codex, or a fu
 
 Seven rules govern every change. Cite them by name when a decision touches one.
 
-1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract.
+1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. Explicit `--engine`, `--risk-probes`, and `--pair-verify` routes fail closed; automatic VERIFY pair is capability-gated and reports an unavailable-engine solo route.
 2. **No overengineering** — smallest change that closes the goal. New abstractions require an observed failure mode they prevent. Subtractive-first: ask "what can I delete instead?" before writing anything new.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER.
 4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
@@ -36,7 +36,7 @@ ideate (optional)  ->  resolve  ->  ship
 
 Each skill's `SKILL.md` is the source of truth for flags and workflow. Do not duplicate.
 
-Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md; measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when this AGENTS.md was present in the project (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4). If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); executor (PLAN/IMPLEMENT/CLEANUP) defaults to `claude`, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; pair judge = first available OTHER engine. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine — instead of editing as `claude`; no pin / no file → unchanged (`claude`). The pair-judge pin stays pipeline-scoped.
+Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md; measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when this AGENTS.md was present in the project (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4). If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); executor (IMPLEMENT/CLEANUP + primary VERIFY judge) defaults to `claude`, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine — instead of editing as `claude`; no pin / no file → unchanged (`claude`). The pair-judge pin stays pipeline-scoped.
 
 Conversational handoff + loop engineering (default entry): the orchestrating model — not the user — invokes the skills. `/devlyn:queue` fronts the intent queue (`docs/specs/queue.md`): no args = status, `add <intent>`, `drain` = serial unattended drain per the contract below. Large agreed work is written to `docs/specs/<id>/spec.md` (always a spec file — the user's reviewed contract; free-form large assumes-and-logs instead of halting, zero-scope-signal goals still halt to ideate), summarized once for user review, then run hands-free via `--spec`. Outer loop per task: findings-backed verdicts (NEEDS_WORK, verify/build-gate exhaustion) get spec amendment + re-run, max 3 iterations; infrastructure / invalid-input / engine-availability / implement-empty BLOCKED verdicts surface immediately. Unattended queue drain (`docs/specs/queue.md`, strictly serial): assumptions may only take scope-narrowing, reversible, non-user-visible defaults — material ambiguity marks the item `[F] needs-review` and the drain continues.
 
@@ -81,7 +81,7 @@ No silent fallbacks.
 - Fallbacks allowed only when widely accepted and harmless (CSS fallback fonts, CDN failover, image placeholders).
 - Silent `catch` blocks are bugs.
 - Logging is not user-visible error handling.
-- No engine-availability fallback for EXPLICITLY-requested routes (`--engine`, `--risk-probes`, `--pair-verify`): if the required engine is unavailable, emit `BLOCKED:codex-unavailable` or `BLOCKED:claude-unavailable` with setup guidance; never downgrade an explicit route to solo. Automatic high-risk escalations (auto risk-probes / auto VERIFY pair) are capability-gated: they activate only when the OTHER engine is available, else the run proceeds solo and reports the skip (route selection, not a fallback — keeps single-LLM users first-class). `--no-pair` and `--no-risk-probes` remain explicit opt-outs.
+- Engine availability follows **No workaround** principle 1: explicit routes fail closed; automatic routes are capability-gated and report a solo skip when OTHER is unavailable. No fallback.
 
 ## Evidence Over Claim
 

package/CLAUDE.md

@@ -10,7 +10,7 @@ This contract serves one goal: any capable engine — Claude, GPT/Codex, or a fu
 
 Seven rules govern every change. Cite them by name when a decision touches one.
 
-1. **No workaround** — fix the root cause, never the symptom. Blocked patterns: `any`, `@ts-ignore`, silent `catch`, hardcoded fallback hiding a broken contract, config-level skip bypassing the real issue, helper script that routes around it. **Permitted exceptions** (widely-accepted defaults only): CSS fallback fonts, CDN failover, image placeholders. **No engine-availability fallback** for EXPLICITLY-requested `/devlyn:resolve` routes (`--engine`, `--risk-probes`, `--pair-verify`) — if the required engine is unavailable, stop with `BLOCKED:codex-unavailable` or `BLOCKED:claude-unavailable` and setup guidance; never downgrade an explicit route to solo. AUTOMATIC high-risk escalations (auto risk-probes / auto VERIFY pair) are capability-gated: they activate only when the OTHER engine is available; otherwise the run proceeds solo and reports the skip — route selection, not a fallback, and the reason single-LLM users stay first-class. `--no-pair` / `--no-risk-probes` remain explicit opt-outs.
+1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses. Explicit `--engine`, `--risk-probes`, and `--pair-verify` routes fail closed when a required engine is unavailable. Automatic risk probes remain high-risk-gated; VERIFY pair is default-when-available. An unavailable OTHER engine routes automatic VERIFY solo with a reported skip. `--no-pair` and `--no-risk-probes` remain explicit opt-outs.
 2. **No overengineering** — smallest change that closes the goal. New abstractions require an observed failure mode they prevent. Subtractive-first: ask "what can I delete instead?" before writing anything new.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
 4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
@@ -40,8 +40,8 @@ Each skill's `SKILL.md` is the source of truth for its flags and workflow — do
 | Role | Default | Manual override |
 |---|---|---|
 | Orchestrator — conversation, handoff, loop driving | whichever CLI you open (contract is symmetric: CLAUDE.md ↔ AGENTS.md). Measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when the project carried the devlyn AGENTS.md (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4) | switch CLIs; the file artifacts (spec/queue/state) carry over |
-| Executor — PLAN/IMPLEMENT/CLEANUP + primary VERIFY judge | `claude` | `--engine <name>` per run, or `/devlyn:engines executor <name>` (durable pin) |
-| Pair judge — VERIFY pair-JUDGE, risk probes | first available OTHER engine (claude↔codex) | `/devlyn:engines pair <name>,...`; `--no-pair` opts out |
+| Executor — IMPLEMENT/CLEANUP + primary VERIFY judge; PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin | `claude` | `--engine <name>` per run, or `/devlyn:engines executor <name>` (durable pin) |
+| Pair judge — default for VERIFY; conditional for risk probes | first available OTHER engine (claude↔codex) | `/devlyn:engines pair <name>,...`; `--no-pair` opts out |
 
 `/devlyn:engines` with no args shows the current role table, detected engines, and how to pin or clear — the pins live in `.devlyn/engines.json`.
 
@@ -158,14 +158,14 @@ A finding without one of these forms is excluded. Vague findings produce vague f
 
 ## Codex invocation
 
-When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine codex` or conditional VERIFY pair/risk-probe routing), the wrapper-form contract lives in `config/skills/_shared/codex-config.md` (or `.claude/skills/_shared/codex-config.md` once installed). Omit `-m <model>` — the CLI's current flagship is used automatically. MCP is not in the loop. If Codex is required and unavailable, stop with `BLOCKED:codex-unavailable` and setup guidance.
+When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine codex`, default VERIFY pair, or conditional risk-probe routing), the wrapper-form contract lives in `config/skills/_shared/codex-config.md` (or `.claude/skills/_shared/codex-config.md` once installed). Omit `-m <model>` — the CLI's current flagship is used automatically. MCP is not in the loop. If Codex is required and unavailable, stop with `BLOCKED:codex-unavailable` and setup guidance.
 
 ## Working Mode
 
 - **Checkpoint with TaskCreate / TaskUpdate.** Long investigations or multi-phase work: create tasks at start, mark completed as each one closes — don't batch.
 - **Don't stop early on token-budget concerns.** Context auto-compacts; the model resumes after compaction. Run the work to a real stopping point.
 - **Persist across context windows via disk.** `/devlyn:resolve` writes `.devlyn/pipeline.state.json` plus per-phase log/findings under `.devlyn/runs/<run_id>/`; for ad-hoc long work use `HANDOFF.md` and resume with `@HANDOFF.md continue`.
-- **Parallelize independent tool calls; reserve `Agent` subagents for independent fan-out or isolated-context verification** — a single perspective is the default on the resolve hot path.
+- **Parallelize independent tool calls; reserve `Agent` subagents for independent fan-out or isolated-context verification** — a single perspective is the default outside VERIFY's dual-judge path.
 
 ## Skill Boundary Policy
 

package/README.md

@@ -106,10 +106,10 @@ Stack tasks to run back-to-back without supervision. `/devlyn:queue add "<intent
 devlyn separates three engine roles:
 
 - **Orchestrator** — the CLI you opened (Claude Code, Codex, or omp) that drives the conversation and loop. The contract is symmetric (`CLAUDE.md` ↔ `AGENTS.md`), so the same phase-gated pipeline runs whichever you launch; the file artifacts (spec, queue, state) carry over if you switch.
-- **Executor** — PLAN / IMPLEMENT / CLEANUP plus the primary VERIFY judge. Defaults to `claude`.
-- **Pair judge** — the first available *other* engine, for conditional VERIFY pair-JUDGE and risk probes.
+- **Executor** — IMPLEMENT / CLEANUP plus the primary VERIFY judge. Defaults to `claude`. PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin.
+- **Pair judge** — the first available *other* engine, default for VERIFY and conditional for risk probes.
 
-`--engine claude` (default) is the canonical implementation surface for PLAN, IMPLEMENT, BUILD_GATE, and CLEANUP. VERIFY/JUDGE conditionally runs pair mode for verify-only runs, high-risk specs, risk probes, mechanical warnings, coverage gaps, or explicit `--pair-verify`.
+`--engine claude` (default) is the canonical implementation surface for IMPLEMENT, BUILD_GATE, and CLEANUP; PLAN always runs on the orchestrator's native worker. VERIFY/JUDGE runs pair mode by default when the OTHER engine is available.
 
 Pin roles durably with `/devlyn:engines` (no args shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins, stored machine-local in `.devlyn/engines.json`). Pins fail closed: an unavailable pinned engine stops with `BLOCKED:<engine>-unavailable`, and a name with no `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines plug in by shipping an adapter file — no skill changes.
 
@@ -119,7 +119,7 @@ Pin roles durably with `/devlyn:engines` (no args shows the role table + detecte
 /devlyn:resolve "fix the auth bug" --engine codex   # research-only
 ```
 
-If Codex or Claude is absent when explicitly selected or conditionally required, the harness stops with `BLOCKED:codex-unavailable` or `BLOCKED:claude-unavailable` and prints setup guidance. Use `--no-pair` only when intentionally accepting solo VERIFY; use `--no-risk-probes` only when intentionally disabling automatic high-risk probes.
+If Codex or Claude is absent when explicitly selected, or OTHER engine is absent under `--pair-verify`, the harness stops with `BLOCKED:<engine>-unavailable` and prints setup guidance. Automatic VERIFY absence is a reported solo route. Use `--no-pair` only when intentionally accepting solo VERIFY; use `--no-risk-probes` only when intentionally disabling automatic high-risk probes.
 
 ### Benchmark score runs
 
@@ -259,7 +259,7 @@ Selected during install. Run `npx devlyn-cli` again to add more.
 |---|---|
 | `playwright` | Playwright MCP — powers `/devlyn:resolve` BUILD_GATE browser tier (Chrome MCP → Playwright → curl fallback) |
 
-> `--engine codex` and conditional VERIFY pair mode use the local `codex` CLI binary, not MCP. Install from https://platform.openai.com/docs/codex, run the current Codex auth/login flow, verify `codex --version`, then rerun.
+> `--engine codex` and default-when-available VERIFY pair mode use the local `codex` CLI binary, not MCP. Install from https://platform.openai.com/docs/codex, run the current Codex auth/login flow, verify `codex --version`, then rerun.
 
 </details>
 

package/benchmark/auto-resolve/fixtures/SCHEMA.md

@@ -123,7 +123,7 @@ Machine-readable acceptance criteria used by both `run-fixture.sh` verification
 
 Fixtures with `metadata.json` `category: "high-risk"` must include at least
 one resolve risk-trigger term in `metadata.intent` or `spec.md`, matching the
-conditional pair/risk-probe triggers used by `/devlyn:resolve`: security/auth,
+conditional risk-probe triggers used by `/devlyn:resolve`: security/auth,
 money/pricing/tax/ledger, persistence/data mutation, idempotency/replay,
 API/webhook/signature, allocation/scheduling/inventory/rollback/transaction,
 priority, or output/response-shape contracts. This keeps future pair-evidence

package/benchmark/auto-resolve/scripts/pair_evidence_contract.py

@@ -10,6 +10,7 @@ from typing import Any
 
 ALLOWED_PAIR_ARMS = {"l2_risk_probes", "l2_gated"}
 CANONICAL_PAIR_TRIGGER_REASONS = {
+    "pair.default",
     "mode.verify-only",
     "mode.pair-verify",
     "complexity.high",

package/benchmark/auto-resolve/scripts/run-fixture.sh

@@ -744,8 +744,18 @@ verify = {"commands": [], "forbidden_pattern_hits": [], "deps_added": 0,
 
 for vc in expected.get("verification_commands", []):
     try:
+        timeout_sec = vc.get("timeout_sec", 60)
+        if (
+            isinstance(timeout_sec, bool)
+            or not isinstance(timeout_sec, int)
+            or not 1 <= timeout_sec <= 600
+        ):
+            raise ValueError(
+                "timeout_sec must be an integer from 1 to 600 (bool is not allowed)"
+            )
         proc = subprocess.run(vc["cmd"], cwd=work, shell=True, env=verify_env,
-                              capture_output=True, text=True, timeout=60)
+                              capture_output=True, text=True,
+                              timeout=timeout_sec)
         out = (proc.stdout or "") + (proc.stderr or "")
         ok_exit = proc.returncode == vc.get("exit_code", 0)
         ok_contains = all(s in out for s in vc.get("stdout_contains", []))

package/benchmark/auto-resolve/scripts/test-benchmark-arg-parsing.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 TMP="$(mktemp -d)"
 BENCH_ROOT="$ROOT/benchmark/auto-resolve"
-trap 'rm -rf "$TMP"; rm -rf "$BENCH_ROOT/results/arg-parse-command-test" "$BENCH_ROOT/results/arg-parse-discovery-test" "$BENCH_ROOT/results/arg-parse-shadow-suite-dry-run" "$BENCH_ROOT/results/arg-parse-shadow-cli-suite-dry-run" "$BENCH_ROOT/results/arg-parse-variant-path" "$BENCH_ROOT/results/arg-parse-headroom-cli-replay" "$BENCH_ROOT/results/arg-parse-pair-cli-replay" "$BENCH_ROOT/results/arg-parse-shadow-judge" "$BENCH_ROOT/results/arg-parse-opus-bad-mapping" "$BENCH_ROOT/results/arg-parse-opus-malformed-mapping" "$BENCH_ROOT/results/arg-parse-opus-malformed-score" "$BENCH_ROOT/results/arg-parse-opus-invalid-generated-score" "$BENCH_ROOT/results/arg-parse-opus-invalid-generated-dq" "$BENCH_ROOT/results/arg-parse-opus-summary-mapping" "$BENCH_ROOT/results/arg-parse-opus-summary-null-margin"; rm -rf /tmp/bench-arg-parse-variant-path-* /tmp/bench-arg-parse-headroom-cli-replay-*' EXIT
+trap 'rm -rf "$TMP"; rm -rf "$BENCH_ROOT/results/arg-parse-command-test" "$BENCH_ROOT/results/arg-parse-discovery-test" "$BENCH_ROOT/results/arg-parse-shadow-suite-dry-run" "$BENCH_ROOT/results/arg-parse-shadow-cli-suite-dry-run" "$BENCH_ROOT/results/arg-parse-variant-path" "$BENCH_ROOT/results/arg-parse-timeout-budget" "$BENCH_ROOT/results/arg-parse-headroom-cli-replay" "$BENCH_ROOT/results/arg-parse-pair-cli-replay" "$BENCH_ROOT/results/arg-parse-shadow-judge" "$BENCH_ROOT/results/arg-parse-opus-bad-mapping" "$BENCH_ROOT/results/arg-parse-opus-malformed-mapping" "$BENCH_ROOT/results/arg-parse-opus-malformed-score" "$BENCH_ROOT/results/arg-parse-opus-invalid-generated-score" "$BENCH_ROOT/results/arg-parse-opus-invalid-generated-dq" "$BENCH_ROOT/results/arg-parse-opus-summary-mapping" "$BENCH_ROOT/results/arg-parse-opus-summary-null-margin" "$BENCH_ROOT/shadow-fixtures/arg-parse-timeout-budget"; rm -rf /tmp/bench-arg-parse-variant-path-* /tmp/bench-arg-parse-timeout-budget-* /tmp/bench-arg-parse-headroom-cli-replay-*' EXIT
 
 expect_fail_contains() {
   local name="$1"
@@ -849,6 +849,88 @@ if grep -Fq -- '--engine auto' \
   exit 1
 fi
 mkdir -p "$BENCH_ROOT/shadow-fixtures"
+rm -rf "$BENCH_ROOT/shadow-fixtures/arg-parse-timeout-budget" \
+  "$BENCH_ROOT/results/arg-parse-timeout-budget"
+cp -R "$BENCH_ROOT/fixtures/F1-cli-trivial-flag" \
+  "$BENCH_ROOT/shadow-fixtures/arg-parse-timeout-budget"
+python3 - "$BENCH_ROOT/shadow-fixtures/arg-parse-timeout-budget/expected.json" <<'PY'
+import json
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+expected = json.loads(path.read_text())
+expected["verification_commands"] = [
+    {"cmd": "true"},
+    {"cmd": "true", "timeout_sec": 1},
+    {"cmd": "true", "timeout_sec": 600},
+    {"cmd": "true", "timeout_sec": True},
+    {"cmd": "true", "timeout_sec": 601},
+    {
+        "cmd": "python3 -c \"import time; time.sleep(2)\"",
+        "timeout_sec": 1,
+    },
+    {
+        "cmd": "python3 -c \"import time; time.sleep(1)\"",
+        "timeout_sec": 5,
+    },
+]
+path.write_text(json.dumps(expected, indent=2) + "\n")
+PY
+bash "$ROOT/benchmark/auto-resolve/scripts/run-fixture.sh" \
+  --fixture arg-parse-timeout-budget \
+  --arm bare \
+  --run-id arg-parse-timeout-budget \
+  --dry-run > "$TMP/timeout-budget-dry-run.out" 2>&1
+python3 - "$BENCH_ROOT/results/arg-parse-timeout-budget/arg-parse-timeout-budget/bare/verify.json" <<'PY'
+import json
+import pathlib
+import sys
+
+commands = json.loads(pathlib.Path(sys.argv[1]).read_text())["commands"]
+assert commands[0]["pass"] is True, commands
+assert commands[1]["pass"] is True, commands
+assert commands[2]["pass"] is True, commands
+expected_error = (
+    "error:ValueError:timeout_sec must be an integer from 1 to 600 "
+    "(bool is not allowed)"
+)
+assert commands[3]["pass"] is False and commands[3]["reason"] == expected_error, commands
+assert commands[4]["pass"] is False and commands[4]["reason"] == expected_error, commands
+assert commands[5]["reason"] == "timeout", commands
+assert commands[6]["pass"] is True, commands
+PY
+
+TIMEOUT_LINT_ROOT="$TMP/timeout-lint-fixtures"
+mkdir -p "$TIMEOUT_LINT_ROOT"
+cp -R "$BENCH_ROOT/fixtures/F1-cli-trivial-flag" \
+  "$TIMEOUT_LINT_ROOT/F1-cli-trivial-flag"
+python3 - "$TIMEOUT_LINT_ROOT/F1-cli-trivial-flag/expected.json" <<'PY'
+import json
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+expected = json.loads(path.read_text())
+expected["verification_commands"][0]["timeout_sec"] = 600
+path.write_text(json.dumps(expected, indent=2) + "\n")
+PY
+DEVLYN_FIXTURES_DIR="$TIMEOUT_LINT_ROOT" DEVLYN_LINT_FIXTURES_NO_JSONSCHEMA=1 \
+  bash "$ROOT/scripts/lint-fixtures.sh" > "$TMP/timeout-lint-pass.out" 2>&1
+python3 - "$TIMEOUT_LINT_ROOT/F1-cli-trivial-flag/expected.json" <<'PY'
+import json
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+expected = json.loads(path.read_text())
+expected["verification_commands"][0]["timeout_sec"] = True
+path.write_text(json.dumps(expected, indent=2) + "\n")
+PY
+expect_fail_contains timeout-lint-bool \
+  "timeout_sec must be an integer from 1 to 600" \
+  env DEVLYN_FIXTURES_DIR="$TIMEOUT_LINT_ROOT" DEVLYN_LINT_FIXTURES_NO_JSONSCHEMA=1 \
+    bash "$ROOT/scripts/lint-fixtures.sh"
 rm -rf "$BENCH_ROOT/shadow-fixtures/arg-parse-nan-metadata" \
   "$BENCH_ROOT/shadow-fixtures/arg-parse-nan-expected" \
   "$BENCH_ROOT/results/arg-parse-nan-metadata" \

package/bin/devlyn.js

@@ -16,6 +16,7 @@ const PKG = require('../package.json');
 // ui-*) stay Claude-core-only, matching the pre-existing Codex bundle.
 const DEVLYN_CORE_SKILLS = ['devlyn:resolve', 'devlyn:ideate', 'devlyn:design-ui', 'devlyn:engines', 'devlyn:queue', '_shared'];
 const DEVLYN_SKILL_DIR_STAMP = '__DEVLYN_SKILL_DIR__';
+const DEVLYN_INSTALL_MARKER = '.devlyn-install.json';
 
 // Cross-agent shared skills directory read by BOTH oh-my-pi and Pi. Verified
 // from the omp binary's skill-provider strings ("skills from .agents/skills —
@@ -354,6 +355,39 @@ function copyRecursive(src, dest, baseDir) {
   }
 }
 
+function clearInstallMarker(skillsDir) {
+  fs.rmSync(path.join(skillsDir, DEVLYN_INSTALL_MARKER), { force: true });
+}
+
+function assertCompleteSkillInstall(sourceSkillsDir, skillsDir, skillNames) {
+  const missing = skillNames.filter((skillName) =>
+    !fs.existsSync(path.join(sourceSkillsDir, skillName))
+      || !fs.existsSync(path.join(skillsDir, skillName)));
+  if (missing.length > 0) {
+    throw new Error(`Incomplete devlyn skill install; missing: ${missing.join(', ')}`);
+  }
+}
+
+function writeInstallMarker(skillsDir) {
+  const markerPath = path.join(skillsDir, DEVLYN_INSTALL_MARKER);
+  const tempPath = `${markerPath}.${process.pid}.tmp`;
+  const marker = {
+    schemaVersion: 1,
+    package: PKG.name,
+    version: PKG.version,
+  };
+  try {
+    fs.writeFileSync(tempPath, JSON.stringify(marker, null, 2) + '\n', {
+      encoding: 'utf8',
+      flag: 'wx',
+      mode: 0o600,
+    });
+    fs.renameSync(tempPath, markerPath);
+  } finally {
+    fs.rmSync(tempPath, { force: true });
+  }
+}
+
 function shellDoubleQuoteDefault(value) {
   if (value.includes('\n')) {
     throw new Error(`Cannot stamp skill path with newline: ${value}`);
@@ -594,10 +628,10 @@ function installSkillsForCLI(cliKey) {
   if (!cli || !cli.skillsDir || !cli.skillsToInstall) return 0;
 
   const sourceSkillsDir = path.join(CONFIG_SOURCE, 'skills');
-  if (!fs.existsSync(sourceSkillsDir)) return 0;
   if (!fs.existsSync(cli.skillsDir)) {
     fs.mkdirSync(cli.skillsDir, { recursive: true });
   }
+  clearInstallMarker(cli.skillsDir);
 
   const removed = cleanupDeprecated(path.dirname(cli.skillsDir));
   if (removed > 0) {
@@ -619,6 +653,8 @@ function installSkillsForCLI(cliKey) {
     copied++;
     log(`  → ${cli.skillsDir.replace(os.homedir(), '~')}/${skillName}`, 'dim');
   }
+  assertCompleteSkillInstall(sourceSkillsDir, cli.skillsDir, cli.skillsToInstall);
+  writeInstallMarker(cli.skillsDir);
   return copied;
 }
 
@@ -726,15 +762,20 @@ function installAgentsForAllDetected() {
 // is chosen. Behavior is unchanged from the previous unconditional core install.
 function installClaudeCore() {
   const targetDir = getTargetDir();
+  const skillsDir = path.join(targetDir, 'skills');
   log('\n📁 Installing Claude Code config to .claude/', 'green');
+  if (!fs.existsSync(skillsDir)) fs.mkdirSync(skillsDir, { recursive: true });
+  clearInstallMarker(skillsDir);
   const refreshed = cleanManagedSkillDirs(
     path.join(CONFIG_SOURCE, 'skills'),
-    path.join(targetDir, 'skills'),
+    skillsDir,
   );
   if (refreshed > 0) {
     log(`  🔄 Refreshing ${refreshed} managed skill director${refreshed === 1 ? 'y' : 'ies'}`, 'dim');
   }
   copyRecursive(CONFIG_SOURCE, targetDir, targetDir);
+  assertCompleteSkillInstall(path.join(CONFIG_SOURCE, 'skills'), skillsDir, DEVLYN_CORE_SKILLS);
+  writeInstallMarker(skillsDir);
 
   // Remove deprecated files from previous versions
   const removed = cleanupDeprecated(targetDir);
@@ -751,17 +792,21 @@ function installClaudeCore() {
     log('  → CLAUDE.md', 'dim');
   }
 
-  // Add .devlyn/ (pipeline state directory) to .gitignore
+  // Keep installer-managed pipeline state and install metadata out of git.
   const gitignorePath = path.join(process.cwd(), '.gitignore');
-  const gitignoreEntry = '.devlyn/';
+  const gitignoreEntries = ['.devlyn/', '.claude/skills/.devlyn-install.json'];
   let gitignoreContent = fs.existsSync(gitignorePath)
     ? fs.readFileSync(gitignorePath, 'utf8')
     : '';
-  if (!gitignoreContent.split('\n').some((line) => line.trim() === gitignoreEntry || line.trim() === '.devlyn')) {
+  const gitignoreLines = gitignoreContent.split('\n').map((line) => line.trim());
+  const missingGitignoreEntries = gitignoreEntries.filter((entry) =>
+    !gitignoreLines.includes(entry) && !(entry === '.devlyn/' && gitignoreLines.includes('.devlyn')));
+  if (missingGitignoreEntries.length > 0) {
     const prefix = gitignoreContent && !gitignoreContent.endsWith('\n') ? '\n' : '';
-    const header = gitignoreContent ? '\n# devlyn-cli pipeline state\n' : '# devlyn-cli pipeline state\n';
-    fs.writeFileSync(gitignorePath, gitignoreContent + prefix + header + gitignoreEntry + '\n');
-    log('  → .gitignore (added .devlyn/)', 'dim');
+    const hasManagedHeader = gitignoreLines.includes('# devlyn-cli pipeline state');
+    const header = hasManagedHeader ? '' : gitignoreContent ? '\n# devlyn-cli pipeline state\n' : '# devlyn-cli pipeline state\n';
+    fs.writeFileSync(gitignorePath, gitignoreContent + prefix + header + missingGitignoreEntries.join('\n') + '\n');
+    log(`  → .gitignore (added ${missingGitignoreEntries.join(', ')})`, 'dim');
   }
 
   // Enable agent teams in project settings
@@ -770,14 +815,37 @@ function installClaudeCore() {
   if (fs.existsSync(settingsPath)) {
     try {
       settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
-    } catch {
-      settings = {};
+    } catch (error) {
+      throw new Error(`Cannot merge .claude/settings.json: ${error.message}`);
     }
   }
-  if (!settings.env) settings.env = {};
+  if (!settings || typeof settings !== 'object' || Array.isArray(settings)) {
+    throw new Error('Cannot merge .claude/settings.json: root must be a JSON object');
+  }
+  const hasOwnSetting = (key) => Object.prototype.hasOwnProperty.call(settings, key);
+  let settingsChanged = false;
+  if (!hasOwnSetting('env')) {
+    settings.env = {};
+    settingsChanged = true;
+  }
+  if (!settings.env || typeof settings.env !== 'object' || Array.isArray(settings.env)) {
+    throw new Error('Cannot merge .claude/settings.json: env must be a JSON object');
+  }
   // Auto-allow pipeline state directory and common git commands so resolve doesn't prompt
-  if (!settings.permissions) settings.permissions = {};
-  if (!settings.permissions.allow) settings.permissions.allow = [];
+  if (!hasOwnSetting('permissions')) {
+    settings.permissions = {};
+    settingsChanged = true;
+  }
+  if (!settings.permissions || typeof settings.permissions !== 'object' || Array.isArray(settings.permissions)) {
+    throw new Error('Cannot merge .claude/settings.json: permissions must be a JSON object');
+  }
+  if (!Object.prototype.hasOwnProperty.call(settings.permissions, 'allow')) {
+    settings.permissions.allow = [];
+    settingsChanged = true;
+  }
+  if (!Array.isArray(settings.permissions.allow)) {
+    throw new Error('Cannot merge .claude/settings.json: permissions.allow must be an array');
+  }
   const pipelinePermissions = [
     'Write(.devlyn/**)',
     'Edit(.devlyn/**)',
@@ -787,7 +855,6 @@ function installClaudeCore() {
     'Bash(git status *)',
     'Bash(git log *)',
   ];
-  let settingsChanged = false;
   for (const perm of pipelinePermissions) {
     if (!settings.permissions.allow.includes(perm)) {
       settings.permissions.allow.push(perm);
@@ -798,9 +865,35 @@ function installClaudeCore() {
     settings.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS = '1';
     settingsChanged = true;
   }
+  if (!hasOwnSetting('hooks')) {
+    settings.hooks = {};
+    settingsChanged = true;
+  }
+  if (!settings.hooks || typeof settings.hooks !== 'object' || Array.isArray(settings.hooks)) {
+    throw new Error('Cannot merge .claude/settings.json: hooks must be a JSON object');
+  }
+  if (!Object.prototype.hasOwnProperty.call(settings.hooks, 'Stop')) {
+    settings.hooks.Stop = [];
+    settingsChanged = true;
+  }
+  if (!Array.isArray(settings.hooks.Stop)) {
+    throw new Error('Cannot merge .claude/settings.json: hooks.Stop must be an array');
+  }
+  const stopHookCommand = 'python3 "$CLAUDE_PROJECT_DIR/.claude/skills/_shared/resolve-stop-hook.py"';
+  const stopHookInstalled = settings.hooks.Stop.some((entry) => (
+    entry && Array.isArray(entry.hooks) && entry.hooks.some((hook) => (
+      hook && hook.type === 'command' && hook.command === stopHookCommand
+    ))
+  ));
+  if (!stopHookInstalled) {
+    settings.hooks.Stop.push({
+      hooks: [{ type: 'command', command: stopHookCommand, timeout: 30 }],
+    });
+    settingsChanged = true;
+  }
   if (settingsChanged) {
     fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
-    log('  → settings.json (agent teams + pipeline permissions)', 'dim');
+    log('  → settings.json (agent teams + pipeline permissions + Stop hook)', 'dim');
   }
 
   // Configure global Claude Code settings (~/.claude/settings.json)

package/config/skills/_shared/adapters/README.md

@@ -46,8 +46,8 @@ Keep each section to ≤ 8 lines. Adapters are deltas, not full prompts. If an a
 
 Adapters may add two more sections beyond the base format:
 
-- **`## Role eligibility`** — fixed ASCII fields, one per line: `executor: yes|no`, `pair_judge: yes|no`. Absent section = eligible for both roles (every adapter shipped before iter-0051). Present only when a backend is structurally unable to fill a role — e.g. a completion-only local model has no tool/file-edit access, so it declares `executor: no`. `_shared/engine-preflight.md` and `/devlyn:engines` read this section as a structured marker, not prose, so it validates mechanically.
-- **`## Invocation`** — for backends called over an API instead of a CLI: the concrete request shape (endpoint, JSON body, timeout) and the adapter-declared availability probe (`_shared/engine-preflight.md#role-resolution`'s "an adapter may declare a different probe" hook).
+- **`## Role eligibility`** — fixed ASCII fields, one per line: `executor: yes|no`, `pair_judge: yes|no`. Absent section = eligible for both roles (every adapter shipped before iter-0051). Present only when a backend is structurally unable or not certified for a role — e.g. a completion-only local model has no tool/file-edit access, so it declares `executor: no`. `_shared/engine-preflight.md` and `/devlyn:engines` read this section as a structured marker, not prose, so it validates mechanically.
+- **`## Invocation`** — for backends called over an API or CLI backends with non-default invocation contracts: the concrete request shape (endpoint, JSON body, timeout) and the adapter-declared availability probe (`_shared/engine-preflight.md#role-resolution`'s "an adapter may declare a different probe" hook).
 
 ## When to add a new adapter
 

package/config/skills/_shared/adapters/grok.md

@@ -0,0 +1,99 @@
+# Grok adapter
+
+## Role eligibility
+
+executor: no
+pair_judge: yes
+
+Certification status: the pair-judge seat is wired, reachable, and probe-capable, but not emission-certified; isolation has three independent invariants — tool callability, MCP connection/enumeration, and context injection — and only P-0080-C can certify them; the doctor cannot. Before this change, the shipped recipe connected 65 MCP tools and injected both an MCP reminder and a plugin-skills reminder into the judge's conversation; a durable `pair grok` pin remains gated on follow-up emission registration and the standing seat-fitness rule.
+
+## Invocation
+
+**Availability probe**: `command -v grok >/dev/null 2>&1`; record
+`grok --version` as evidence. The probe is necessary, not sufficient: auth or
+wrapper failures after it passes are the same fail-closed availability class as
+a failed probe (`BLOCKED:grok-unavailable` for an explicit route; an automatic
+escalation remains a reported solo skip).
+
+```bash
+# $ISO_HOME = ephemeral dir seeded with a copied auth.json + agent_id, and a
+#   config.toml containing:
+#   [plugins]
+#   disabled = ["telegram", "vercel"]
+#   enabled = []
+#
+#   [skills]
+#   ignore = ["~/.agents", "~/.claude", "~/.cursor"]
+#   plus $ISO_HOME/hooks/anchor-guard.json. grok reads that file as JSON, not
+#   through a shell, so its "command" must carry an ALREADY-EXPANDED path:
+#   {"hooks":{"PreToolUse":[{"hooks":[{"type":"command",
+#     "command":"python3 /abs/path/to/_shared/grok-anchor-guard.py","timeout":10}]}]}}
+# $NEUTRAL  = empty dir outside any git repo
+# $REPO     = absolute repo root (redirects MUST be absolute — cwd is $NEUTRAL)
+cd "$NEUTRAL"
+HOME="$NEUTRAL" ZDOTDIR="$NEUTRAL" GROK_HOME="$ISO_HOME" \
+DEVLYN_PROBE_ANCHOR="<the bare anchor, derived exactly as the --allow rule below>" \
+GROK_CLAUDE_MCPS_ENABLED=false GROK_CURSOR_MCPS_ENABLED=false \
+GROK_CLAUDE_SKILLS_ENABLED=false GROK_CURSOR_SKILLS_ENABLED=false \
+GROK_CLAUDE_HOOKS_ENABLED=false GROK_CURSOR_HOOKS_ENABLED=false \
+GROK_CLAUDE_AGENTS_ENABLED=false GROK_CLAUDE_RULES_ENABLED=false \
+GROK_MEMORY=0 \
+python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- grok -p "<judge prompt>" \
+  --permission-mode dontAsk --no-memory \
+  --tools "read_file,grep,list_dir,run_terminal_cmd" \
+  --disallowed-tools "Agent,use_tool,search_tool" \
+  --allow 'Bash(<the bare anchor>)' \
+  --reasoning-effort medium \
+  --output-format json \
+  > "$REPO/.devlyn/grok-judge.stdout" 2> "$REPO/.devlyn/grok-judge.stderr"
+```
+
+Copy `auth.json` into `$ISO_HOME` for every run and seed its `config.toml` with
+the shown `[plugins]` and `[skills] ignore` entries and its
+`hooks/anchor-guard.json` with the shown `PreToolUse` entry. Before launch, create
+`$NEUTRAL/.zshenv` containing `export HOME=<the operator's real home>`.
+Both overrides are needed because grok scans `~/.claude.json` from `$HOME`,
+while zsh reads rc files from `$ZDOTDIR`, which is exported in some environments.
+`$NEUTRAL` and `$ISO_HOME` must be on paths that do not embed a project or repo identifier.
+`--permission-mode plan` is forbidden headless because it silently blocks
+all tools and returns an empty review; `--always-approve` is banned because it
+auto-approves writes. `--tools` and `--disallowed-tools` are headless-only (the
+TUI warns and ignores them); when both are present, the disallow list wins and
+removes tools entirely rather than merely gating execution.
+
+Never use `--json-schema` for the pair judge: measured runs degraded the
+tool-use loop (2/3 made zero tool calls and fabricated findings), and a
+`Cancelled` run emitted a PASS-shaped payload after its schema had failed.
+
+The judge prompt must name the exact permitted command(s). Derive the prompt
+anchor and allow-list string identically from one source, in this precedence:
+the solo-headroom hypothesis's backticked observable command when present;
+otherwise the backticked commands in the spec's `## Verification` bullets;
+otherwise the repo's existing test/CLI runner. If none exists, the probe
+obligation does not arise and a static review is correct for that spec.
+The documented `Bash(<command>)` form matches the exact command or its prefix;
+the trailing ` *` form fails a no-argument command.
+Under `dontAsk`, every allow shape tested for a chained command — including an
+exact full-string rule for the chain — returned `PermissionCancelled`, so the
+mandatory dominance-loss anchor must run unchained with the allow rule scoped
+to that bare anchor.
+
+Grok's deny semantics are not Claude-parity: reaching the permission mode's
+auto-deny silently truncates the review at exit 0. On the configured, measured
+path the `PreToolUse` hook above keeps the judge from reaching it — the hook runs
+at step 1, before the rules and before the mode policy, and returns the denial as
+a model-visible `tool_result`.
+It admits the bare anchor and anchor-plus-argv, and vetoes any character that
+could start a second command, so `verify.md`'s bounded input variations survive
+while chaining does not. The hook fails open, so the collector rejection remains
+the fail-closed floor: treat it as `BLOCKED` for
+`verify.pair.emission-contract`, never PASS. After a non-timeout spawn, run:
+
+```bash
+python3 "$DEVLYN_SHARED_DIR/collect-codex-findings.py" \
+  --devlyn-dir "$REPO/.devlyn" \
+  --stdout-file grok-judge.stdout
+```
+
+On exit 124, write `.devlyn/verify.pair.timeout.json` with
+`{"engine": "grok", "budget_seconds": 600}` before merge.